name: CI
on:
push:
branches:
- main
pull_request:
jobs:
check:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Reject insecure workflow installers
shell: bash
run: |
forbidden_patterns=(
'curl[[:space:]].*\|[[:space:]]*sh'
'sh\.rustup\.rs'
'\|[[:space:]]*iex'
)
for pattern in "${forbidden_patterns[@]}"; do
if find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -exec grep -En -- "$pattern" {} +; then
echo "forbidden workflow pattern detected: $pattern" >&2
exit 1
fi
done
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@1.88.0
with:
components: rustfmt, clippy
- name: Check formatting
run: cargo fmt --all --check
- name: Run Clippy
run: cargo clippy --all-targets --all-features -- -D warnings
- name: Enforce file length limits
run: python3 scripts/check_file_lengths.py
- name: Check package and app versions
run: python3 scripts/check_version_sync.py
- name: Check migration fixture freeze
run: python3 scripts/check_migration_matrix.py
- name: Check bundled plans manifest
run: |
python3 scripts/check_plans_manifest.py --self-test
python3 scripts/check_plans_manifest.py
- name: Run tests
run: cargo test
- name: Verify publish package
run: cargo publish --dry-run --locked
- name: List packaged files
run: cargo package --list
rust-macos:
runs-on: macos-15
steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@1.88.0
with:
components: rustfmt, clippy
- name: Run Clippy
run: cargo clippy --all-targets --all-features -- -D warnings
- name: Run tests
run: cargo test
search-benchmark:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-15]
runs-on: ${{ matrix.os }}
steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@1.88.0
- name: Run ignored retrieval benchmark
run: scripts/run_search_benchmark.sh artifacts/search-benchmark/report.json
- name: Upload reviewable benchmark report
uses: actions/upload-artifact@v6
with:
name: search-benchmark-${{ matrix.os }}
path: artifacts/search-benchmark/report.json
menubar-app:
runs-on: macos-15
steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Build menu bar app
run: |
xcodebuild \
-project macos/ClipmemMenuBar/ClipmemMenuBar.xcodeproj \
-scheme ClipmemMenuBar \
-configuration Debug \
-destination 'platform=macOS' \
-derivedDataPath /tmp/clipmem-menubar-ci-build-derived \
CODE_SIGNING_ALLOWED=NO \
build
- name: Test menu bar app
run: |
xcodebuild \
-project macos/ClipmemMenuBar/ClipmemMenuBar.xcodeproj \
-scheme ClipmemMenuBar \
-configuration Debug \
-destination 'platform=macOS' \
-derivedDataPath /tmp/clipmem-menubar-ci-test-derived \
-parallel-testing-enabled NO \
CODE_SIGNING_ALLOWED=NO \
test